{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Strapi vulnerabilities","home_page_url":"https://patchfirst.co/vendor/strapi/","feed_url":"https://patchfirst.co/feed/vendor/strapi.json","description":"New and newly exploited Strapi CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2023-22894#kev","url":"https://patchfirst.co/cve/CVE-2023-22894/","title":"[KEV] CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability","content_text":"Strapi · Strapi. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 4.1% (higher than 90.8% of CVEs). CVSS 4.9 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1212 Exploitation for Credential Access. Priority 74.6 of 100.","summary":"Strapi Cleartext Storage of Sensitive Information Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:20:41.000Z","tags":["kev","public-exploit","T1078","T1212"],"_patchfirst":{"reason":"kev","priority":74.6,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.04114,"percentile":0.90767},"cvss":{"score":4.9,"severity":"MEDIUM","version":"3.1"},"vendor":"Strapi","product":"Strapi","techniqueIds":["T1078","T1212"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}